[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fas-secure-sdlc-sast-dast":4,"config":233},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":8,"name":9,"count":11},{"key":35,"name":36,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":38,"name":39,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":41,"name":42,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":44,"name":45,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":47,"name":48,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":50,"name":51,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":53,"name":54,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":56,"name":57,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":59,"name":60,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":62,"name":63,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":65,"name":66,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":68,"name":69,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":71,"name":72,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":74,"name":75,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":77,"name":78,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":80,"name":81,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":83,"name":84,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":86,"name":87,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":89,"name":90,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":92,"name":93,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":95,"name":96,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":98,"name":99,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":101,"name":102,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":104,"name":105,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":107,"name":108,"count":11},"security-authn-authz","Security Authn Authz",{"key":110,"name":111,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":113,"name":114,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":116,"name":117,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":119,"name":120,"count":11},"security-incident-response","Security Incident Response",{"key":122,"name":123,"count":11},"security-network-security","Security Network Security",{"key":125,"name":126,"count":11},"security-secure-sdlc","Security Secure Sdlc",{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,179,193,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":163,"explanation":165},"019faa33-10ba-7693-ab74-f34b8978a38c",1,"What does a SAST (Static Application Security Testing) tool analyze to find vulnerabilities?",[153,156,159,162],{"key":154,"text":155},"a","Network traffic captured while the application is running in production",{"key":157,"text":158},"b","Log files generated after a deployed application has been running for several days",{"key":160,"text":161},"c","User-reported bug tickets filed after a security incident occurred",{"key":163,"text":164},"d","The application's source code, bytecode, or binaries without executing the program","SAST tools parse source code, bytecode, or binaries directly and reason about control flow and data flow without ever running the application, which is why they can be applied as soon as code exists, even before it compiles into a deployable artifact.",{"id":167,"topic":9,"difficulty":150,"body":168,"options":169,"correct_key":157,"explanation":178},"019faa33-10bb-71ef-8e8a-dc15e9b2695c","What does a DAST (Dynamic Application Security Testing) tool require in order to test an application?",[170,172,174,176],{"key":154,"text":171},"Full read access to the application's source code repository, since DAST is assumed to statically analyze source files for the same patterns SAST would look for",{"key":157,"text":173},"A running instance of the application that it can send requests to and observe responses from",{"key":160,"text":175},"A copy of the compiled binary with debug symbols stripped out",{"key":163,"text":177},"The list of every developer who has committed code to the project","DAST works like a black-box attacker: it needs a deployed, running application (often in a staging environment) so it can send crafted HTTP requests and inspect the actual responses, headers, and behavior. It never reads source code.",{"id":180,"topic":9,"difficulty":181,"body":182,"options":183,"correct_key":157,"explanation":192},"019faa33-10bb-7954-8a28-1b7ee1faca84",2,"A team wants to catch an unsanitized SQL query concatenation bug as early as possible, ideally while a developer is still writing the code before it is even committed. Which testing approach fits this goal best?",[184,186,188,190],{"key":154,"text":185},"DAST run nightly against the staging environment, which still requires the feature to already be deployed and running before any feedback is produced",{"key":157,"text":187},"SAST integrated into the IDE or run on every pull request",{"key":160,"text":189},"Load testing executed right before a production release",{"key":163,"text":191},"Manual penetration testing performed once per quarter","SAST reads the source directly, so it can run inside an IDE plugin or as a pre-commit\u002FPR check, giving feedback before the code is even merged. DAST, penetration testing, and load testing all require a running, often later-stage, deployment.",{"id":194,"topic":9,"difficulty":181,"body":195,"options":196,"correct_key":160,"explanation":205},"019faa33-10bc-73a5-9e62-b25390174d28","Which limitation is most commonly associated with SAST tools?",[197,199,201,203],{"key":154,"text":198},"They cannot be run until the application is deployed to production, since the tool is assumed to need a live HTTP endpoint to inspect, the same way a DAST scanner does",{"key":157,"text":200},"They can only detect vulnerabilities in compiled languages, never in interpreted ones",{"key":160,"text":202},"They tend to produce a meaningful number of false positives because they lack full runtime context",{"key":163,"text":204},"They require the application to be under active attack to generate any findings","Because SAST reasons about code paths statically, without knowing exact runtime values, configuration, or how components are actually wired together, it often flags patterns that look risky but are not exploitable in practice, producing false positives that need triage.",{"id":207,"topic":9,"difficulty":181,"body":208,"options":209,"correct_key":154,"explanation":218},"019faa33-10bc-79fe-9d50-4db716165a3b","Which limitation is most commonly associated with DAST tools?",[210,212,214,216],{"key":154,"text":211},"They can only find issues in code paths that are actually exercised by the requests they send during the scan",{"key":157,"text":213},"They cannot be automated and must always be operated manually by a human tester, because interpreting an HTTP response for a real vulnerability is assumed to require human judgment that no scripted crawler can replicate",{"key":160,"text":215},"They require the full source code of every dependency to be provided in advance",{"key":163,"text":217},"They can only run against applications written in memory-unsafe languages such as C","DAST behaves like an outside attacker sending requests, so any code path, endpoint, or feature it never reaches (e.g. behind an unusual auth flow, a rarely used admin form) stays untested. Coverage depends entirely on what the scan crawls or is configured to hit.",{"id":220,"topic":9,"difficulty":221,"body":222,"options":223,"correct_key":163,"explanation":232},"019faa33-10bd-733c-8a93-80807a70490f",3,"IAST (Interactive Application Security Testing) tools are typically described as combining aspects of SAST and DAST. What is the core idea behind this hybrid approach?",[224,226,228,230],{"key":154,"text":225},"IAST replaces automated scanning entirely with a checklist filled out manually by developers",{"key":157,"text":227},"IAST only scans the network perimeter and never looks inside the running application process",{"key":160,"text":229},"IAST is simply DAST renamed, with no actual technical difference between the two",{"key":163,"text":231},"IAST instruments the running application with an agent, so it observes real code execution while functional or DAST-style tests exercise it","IAST places an instrumentation agent inside the running application (similar to how SAST understands code) and then observes what actually executes as the app is driven by functional tests or DAST traffic, combining code-level visibility with real runtime behavior.",{"fields":234,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[235,260,280,296,320,333,352,371,381,388,394,401],{"key":236,"name_tr":237,"name_en":237,"sort":150,"specializations":238},"backend","Backend",[239,242,245,248,251,254,257],{"key":240,"name":241,"field":236},"general","Genel",{"key":243,"name":244,"field":236},"go","Go",{"key":246,"name":247,"field":236},"python","Python",{"key":249,"name":250,"field":236},"java","Java",{"key":252,"name":253,"field":236},"csharp","C#\u002F.NET",{"key":255,"name":256,"field":236},"nodejs","Node.js",{"key":258,"name":259,"field":236},"php","PHP",{"key":261,"name_tr":262,"name_en":262,"sort":181,"specializations":263},"frontend","Frontend",[264,265,268,271,274,277],{"key":240,"name":241,"field":261},{"key":266,"name":267,"field":261},"javascript","JavaScript",{"key":269,"name":270,"field":261},"typescript","TypeScript",{"key":272,"name":273,"field":261},"react","React",{"key":275,"name":276,"field":261},"vue","Vue",{"key":278,"name":279,"field":261},"angular","Angular",{"key":281,"name_tr":282,"name_en":282,"sort":221,"specializations":283},"fullstack","Fullstack",[284,285,286,287,288,289,290,291,292,293,294,295],{"key":240,"name":241,"field":281},{"key":243,"name":244,"field":236},{"key":246,"name":247,"field":236},{"key":249,"name":250,"field":236},{"key":252,"name":253,"field":236},{"key":255,"name":256,"field":236},{"key":258,"name":259,"field":236},{"key":266,"name":267,"field":261},{"key":269,"name":270,"field":261},{"key":272,"name":273,"field":261},{"key":275,"name":276,"field":261},{"key":278,"name":279,"field":261},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":240,"name":241,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":240,"name":241,"field":321},{"key":246,"name":247,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":240,"name":241,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":240,"name":241,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":240,"name":241,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":240,"name":241,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":240,"name":241,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":240,"name":241,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":240,"name":241,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]